Loading story…
Capcom disclosed that unauthorized third-party access disrupted parts of its corporate network, affecting internal email and file servers and forcing the company to suspend some network operations to contain the incident. The company said online gameplay services and public websites were not impacted, but investor-relations responses and document requests were delayed while systems were restored and the matter was reported to law enforcement.
Reporting tied the intrusion to Ragnar Locker ransomware after a related sample and ransom note surfaced, with the gang claiming it encrypted about 2,000 devices and stole more than 1 TB of unencrypted data from Capcom systems in Japan, the United States, and Canada. The attackers allegedly demanded $11 million in bitcoin in exchange for a decryptor, deletion of stolen files, and a network penetration report, while leaked samples were said to include financial records, employee documents, contracts, and internal communications.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
According to the new reference, the Ragnar Locker group published a public claim of responsibility for the Capcom intrusion on its leak infrastructure. The post was separate from the earlier ransom note details already reported and marked a public extortion step by the attackers.
Ragnar Locker's ransom note claimed the attackers stole more than 1 TB of unencrypted sensitive data from Capcom systems in Japan, the United States, and Canada and encrypted 2,000 devices. The gang allegedly demanded $11 million in bitcoin for a decryptor, deletion of stolen data, and a network penetration report.
Reporting on November 5 said evidence from a ransomware sample and ransom note indicated the Ragnar Locker gang was responsible for the attack. An update also said the incident may have been caused by Ragnar Locker ransomware.
Capcom disclosed the incident on November 5, stating that unauthorized access had impacted certain internal systems including email and file servers. The company said there was no indication at that stage that customer information had been compromised.
Beginning in the early morning of November 2, 2020, Capcom said unauthorized third-party access caused issues on parts of the Capcom Group network, affecting email and file servers. The company halted some internal network operations to contain the incident and said online gameplay services and public websites were not affected.
After detecting the intrusion, Capcom reported the cyberattack to law enforcement while working to restore impacted systems. The disclosure also noted disruption to investor-relations responses and document requests during recovery.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
coveware.com
Open sourcembsd.jp
Open sourcezdnet.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI and CISA issued a joint FLASH warning that the **Ragnar Locker** ransomware gang breached at least **52 organizations across 10 U.S. critical infrastructure sectors**, including critical manufacturing, energy, financial services, government, and information technology. The agencies said the group has been active since at least late 2019 and uses **double extortion**, stealing data before encrypting systems and threatening to publish stolen files on its leak site; stolen data from at least 10 victims had already been posted. The alert detailed Ragnar Locker tradecraft, including use of **VMProtect**, **UPX**, and custom packing, deployment from a custom **Windows XP virtual machine**, locale checks that halt execution on some CIS-region language settings, termination of services and remote management tools such as **ConnectWise** and **Kaseya**, deletion of shadow copies, and selective encryption exclusions. The FBI published indicators including infrastructure, IP addresses, Bitcoin wallets, and operator email addresses tied to access, command-and-control, and exfiltration activity, and urged organizations to report incidents, preserve artifacts, avoid ransom payments, and strengthen defenses with offline backups, MFA, patching, RDP hardening, least-privilege access, and network segmentation.
Aug 15, 2026
Insomniac Games said it was the victim of a ransomware attack after the Rhysida gang published stolen material that reportedly included employee personal data and internal company files. The studio described the incident as "extremely distressing," said it was working quickly to determine what data was affected, and notified current and former employees whose information may have been exposed. Reports on the leak said the dumped files also contained development material tied to upcoming projects, intensifying the impact beyond privacy risks. The breach added Insomniac, a Sony-owned game developer known for the *Marvel's Spider-Man* franchise, to a growing list of entertainment and technology companies hit by extortion-driven intrusions. Public reporting indicated the attackers had attempted to auction the stolen data before releasing it, a tactic increasingly used by ransomware groups to pressure victims even when encryption is not the primary disruption. The incident highlighted the dual business risk of modern breaches: exposure of sensitive workforce records and theft of commercially valuable intellectual property.
Jul 12, 2026
The University of Hawaiʻi Cancer Center confirmed a **ransomware-driven data breach** affecting its epidemiology division, with the potential exposure of data tied to up to **1.2 million individuals**. The university reported that attackers accessed files containing **SSNs and driver’s license numbers** sourced from historical Hawaiʻi DOT records and Honolulu voter registration data (dating back to 1998), as well as health-related research data connected to the **Multiethnic Cohort (MEC) Study** and other diet-and-cancer studies; the incident was discovered on **August 31, 2025**, and the university acknowledged it engaged with the threat actors while restoration and impact assessment were underway. Separately, a “cyber incident” caused a **five-school-day internet outage** at the Denmark School District in Wisconsin; the **INC Ransom** group claimed the victim on its leak site, alleging both **encryption** and theft of roughly **70.76 GB** of data, though the district had not publicly confirmed ransomware or data exfiltration. In the healthcare sector, **Insight Hospital and Medical Center** in Chicago reported unauthorized network access between **August 22 and September 11, 2025**, and the **Termite** group later claimed to have stolen and then **leaked ~360 GB** (about 900,000 files) of “confidential data,” including medical imaging files (e.g., `.dcm`), raising the likelihood of exposure of both identity data and protected health information.
Jun 29, 2026